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AMENDMENTS TO THE CLAIMS : 

This listing of claims will replace all prior versions and listings of claims in the 
application: 

Listing of Claims : 

1 . (Currently Amended) A method of monitoring a plurality of local event logs of a 
computer network, the method comprising: 

entering the local event logs in a central database of the computer network, and 

sending the central database from the computer network to an external support 
computer system for analysis of the entifelv- entiretv of the local event logs since a last 
analysis of the local event logs. 

2. (Currently Amended) The method of claim 1, wherein each local event log is 
generated for one particular node of the computer network, and storing the local event 
logs in [[-]] the central database using a corresponding node identifier as a key. 

3. (Original) The method of claim 1, the computer network comprising a server 
computer for storing the central database, the server computer having a local server 
event log, the method further comprising storing the local server event log in the central 
database, and sending the central database from the server computer of the computer 
network to the external support computer system. 

4. (Original) The method of claim 3, further comprising entering an event into the 
local server event log after the central database has been sent to the external support 
computer system. 
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5. (Original) The method of claim 1, wherein each event log entry in a local event 
log has an event identifier, a time stamp and event information descriptive of the event. 

6. (Original) The method of claim 1, wherein the central database is stored on a 
server computer of the computer network, and further comprising the steps of: 

coupling program code from the server computer to network nodes of the 
computer network, and 

transferring the local event logs of the network nodes to the server computer by 
remotely executing the program code by the server computer on the network nodes. 

7. (Currently Amended) A memory storing a computer program for causing a 
computer network to generate a central database for storing local event logs of network 
nodes of the computer network, the computer program causing the computer network to 
perform the steps of: 

transmitting the respective local event logs from the network nodes to a server 
computer of the computer network, 

storing the local event logs in the central database on the server computer using 
the node identifiers of the network nodes as keys for the respective local event logs, 
and 

storing a local server event log of the server computer in the central database, 
the local server event log being adapted to store a send event after the central database 
has been sent to an external support computer system for analysis of the local event 
logs; 

wherein an e ntir el y entirety of the local event logs are stored since a last analysis 
of the local event logs. 
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8. (Currently Amended) The memory of claim 7, wherein the program causes the 
network to send the central database to the external support computer system at 
customisabl o p o riodi c confiqurable time intervals. 

9. (Original) The memory of claim 7, wherein the program includes program code 
for remote execution on the network nodes to cause the network nodes to send the 
respective local event logs to the server computer. 

10. (Currently Amended) A server computer system of a computer network having 
a plurality of network nodes, the server computer system comprising: 

a controller for causing the network nodes to transmit respective local event logs 
of the network nodes to the server computer system, 

a store for the local event logs in a central database, and 

a transmitter for sending the central database to an external support computer 
system for analysis of the local event logs; 

wherein an enfoelv -entiretv of the local event logs are stored since a last analysis 
of the local event logs. 

11. (Original) The server computer system of claim 10, further comprising a local 
server event log for storing an event in response to the central database being sent to 
the external support computer system, the send event having a time stamp. 

12. (Currently Amended) A discovery server comprising: 

a discovery program component for discovery of network nodes of a computer 
network, 
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a remote execution program component for causing the network nodes to 
transmit respective local event logs to the discovery server, 

a central database for storing the local event logs and for storing a local 
discovery server event log, and 

an interface component for sending the central database to the external support 
computer system for analysis of the e ntirely e ntirety t he local event logs since a last 
analysis of the local event logs. 

13. (Original) The discovery server of claim 12, wherein the local discovery server 
event log is adapted to store an event indicative of a transfer of the central database 
from the discovery server to the external support computer system. 

14. (Currently Amended) A method of monitoring a plurality of local event logs, the 
method comprising the steps of: 

receiving a database from a customer computer network, the database 
comprising the local event logs of network nodes of the computer network, 

querying the database to identify a database send event in the local event logs 
and its corresponding sent time stamp, and 

querying the database to identify local event log entries having time stamps later 
than the sent time stamp; 

wherein an e ntir el y e ntirety of the local event logs are stored since a last analysis 
of the local event logs. 

15. (Original) The method of claim 14, further comprising comparing the identified 
event log entries to rules of alert policies to determine whether an alert action should be 
invoked. 
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16. (Original) The method of claim 15, further comprising sending an email message 
to a response center engineer as an alert action. 

17. (Currently Amended) A memory storing a computer program for enabling a 
computer to monitor plural local event logs of a computer network, the computer 
program causing the computer to perform the steps of: 

storing a database associated with a customer computer network, the database 
comprising the local event logs of network nodes of the computer network, 

querying the database to identify a database send event in the local event logs 
and its corresponding sent time stamp, and 

querying the database to identify local event log entries having time stamps later 
than the sent time stamp; 

wherein an e ntir e ly e ntirety of the local event logs are stored since a last analysis 
of the local event logs ; and 

wherein the computer program causes the computer to receive from the 
customer computer network the database associated with the customer computer 
network . 

18. (Original) The memory of claim 17, wherein the program causes the computer to 
determine whether an alert action should be invoked by comparing the identified event 
log entries to rules of alert policies. 

19. (Original) The memory of claim 18, wherein the program causes the computer to 
send an automatic notification to a response center engineer if the determining step 
determines an alert action should be invoked. 
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20. (Canceled). 

21 . (Currently Amended) A support computer system for providing network support 
services for a customer computer network, the support computer system comprising: 

a memory for storing a database associated with the customer computer 
network, the database comprising local event logs of network nodes of the customer 
computer network, 

a database query component for querying the database to determine a database 
send event and its corresponding transfer time stamp in the database and for querying 
the database to identify event log entries having time stamps later than the sent time 
stamp, and 

an analysis component for comparing the identified event log entries to the rules 
of alert policies to determine whether an alert action should be invoked; 

wherein an e nt i r e ly entirety of the local event logs are stored since a last analysis 
of the local event logs ; and 

wherein the memory is adapted to receive from the customer's computer network 
the database associated with the customer computer network . 

22. (Canceled). 

23. (Currently Amended) A response center computer system for providing 
network support services for a plurality of customer computer networks, the response 
center computer system comprising: 

a memory for storing a database associated with the customer computer 
network, the database comprising local event logs of network nodes of the customer 

7 



Application No.: 10/697,641 Docket No.; 200309346-2(1509-452) 

computer network wherein an e ntir e ly e ntirety of the local event logs are stored since a 
last analysis of the local event logs, 

a database query component for querying the database to determine a database 
send event and its corresponding transfer time stamp in the database and for querying 
the database to identify event log entries having time stamps later than the sent time 
stamp, 

an analysis component for comparing the identified event log entries with rules of 
alert policies to determine whether an alert action should be invoked, and 

an automatic notification component for sending an email message to a response 
center engineer in response to the analysis component determining that an alert action 
should be invoked. 

24. (Original) A system according to claim 23 wherein the memory is adapted to 
receive from the customer's computer network the database associated with the 
customer computer network. 

25. (Previously Presented) The method of claim 1 comprising: 

discovering network modes of computer network, and causing the network 
modes to transmit their local event logs to be stored in the central database. 

26. (Previously Presented) The method of claim 1, wherein the analysis is performed 
using rules which define a set of alert policies. 
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